CVE-2026-63804gfs2: fix use-after-free in gfs2_qd_dealloc
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending. Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.
Timeline
ID reserved
By Linux
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected a475c5dd16e57c570113eccba51955b5df8bb052 – < 4fe388218826df8607ae41a6305df67db08a9093
- affected a475c5dd16e57c570113eccba51955b5df8bb052 – < 8745d9f7e1682c39f0a1578895ac74205e2a6757
- affected a475c5dd16e57c570113eccba51955b5df8bb052 – < b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0
- affected a475c5dd16e57c570113eccba51955b5df8bb052 – < 9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0
- affected a475c5dd16e57c570113eccba51955b5df8bb052 – < f9c9ec2c319f843b70ecdf939d48b52d189bc081
- affected 6.6
- unaffected < 6.6
- unaffected 6.6.144 – ≤ 6.6.*
- unaffected 6.12.95 – ≤ 6.12.*
- unaffected 6.18.38 – ≤ 6.18.*
- unaffected 7.1.3 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References5
- https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093 (opens in a new tab)
- https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757 (opens in a new tab)
- https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0 (opens in a new tab)
- https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0 (opens in a new tab)
- https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-45470 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-63804)Record last updated .